Software, Security, and Infrastructure Services

System Security Plan: Access Control (excerpt)

Contents

1 Account lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.1 While an account is locked . . . . . . . . . . . . . . . . . . . . . . 1

1 Account lockout

Every interactive account, including administrative and service

accounts, locks after [Assignment: organization-defined number]

consecutive invalid logon attempts within [Assignment: organi-

zation-defined time period]. At the limit the system will [Selec-

tion (one or more): lock the account or node for [Assignment: or-

ganization-defined time period]; lock the account or node until re-

leased by an administrator; delay next logon prompt per [Assign-

ment: organization-defined delay algorithm]; notify system admin-

istrator; take other [Assignment: organization-defined action]].

1.1 While an account is locked

A lock holds for [Assignment: organization-defined time period]

unless an administrator releases it sooner, and a delayed prompt

follows [Assignment: organization-defined delay algorithm]. Any

response beyond those is [Assignment: organization-defined ac-

tion], and every lockout is logged for AU-2 audit collection.